ClawHub
Back to skill

Security audit

问道笔录Game

Security checks across malware telemetry and agentic risk

Overview

This is a coherent text-adventure skill that saves game progress locally, with no evidence of hidden execution, credential access, or data exfiltration.

Install this as a game skill in a dedicated folder. Expect it to create or update game_state.md as your save file, and keep a backup if you care about preserving a prior run; be explicit when declining or discarding inventory items.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Low
Confidence
93% confidence
Finding
The documentation creates contradictory handling for discard decisions: one section treats inputs like "不要"/"放弃" as an explicit refusal to accept the new item, while another example classifies "不要了" as ambiguous and triggers automatic dropping of an existing item. In an interactive inventory system, this can cause unintended loss of player assets because a reasonable negative response may be misinterpreted as consent to destructive auto-discard behavior.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill instructs the agent to read and modify `game_state.md` as part of normal operation, but it does not present an upfront warning that user data will be changed. In an agent setting, silent state mutation can lead to unintended or surprising file edits, especially if a user asks for status information and the workflow later performs writes without clear confirmation boundaries.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.